# no-implied-eval

> Disallow passing a string of code to `setTimeout()`, `setInterval()` or `execScript()`

When the first argument of `setTimeout()` or `setInterval()` is a string, browsers compile and run it like `eval()` does. The code runs in the global scope, so it can't see your local variables, and anything a user typed that ends up in the string gets executed.

{/* Generated by src/codegen/lint-rule-docs.ts. Do not edit this section. */}

## Configure

Off by default. To turn it on:

```toml bunfig.toml
[lint.rules]
"no-implied-eval" = "error" # or "warn"
```

{/* End of the generated section. */}

## Examples

Reported:

{/* bad {"count": 3} */}
```js
setTimeout("refresh()", 1000);
setInterval("poll('" + url + "')", 5000);
window.setTimeout(`save(${id})`, 0);
```

The rule follows a constant that holds a string:

{/* bad */}
```js
const code = "refresh()";
setTimeout(code, 1000);
```

Not reported:

{/* good */}
```js
setTimeout(refresh, 1000);
setInterval(() => poll(url), 5000);
window.setTimeout(() => save(id), 0);
```

Your own function with the same name isn't reported:

{/* good */}
```js
import { setTimeout } from "./fake-timers.js";

setTimeout("tick", 1000);
```